Policy & Regulation
US seizes domains of Chinese botnet tied to NASA, DOJ, Senate hacks
The FBI seized a series of domains used by a large-scale, allegedly China-backed botnet, which the Justice Department says targeted NASA, the Justice Department itself, and the US Senate as recently as 2026.
The FBI has seized domains that a large-scale botnet used to coordinate and launch cyberattacks against American targets, attacks the Justice Department says were backed by the Chinese government. The department said Wednesday the seizures deny the botnet’s operators access to the platforms. The botnet was allegedly used by the Chinese government to break into computers across the United States, including systems at hospitals, defense contractors, and several federal government departments.
Prosecutors said the China state-sponsored group, known as QTFY, was run by a Chinese company called Nanjing Xinjiuwei Network Tech, which created and operated the botnet — made up of thousands of compromised internet-connected devices — to serve as an obfuscation network that hides hackers’ malicious traffic and makes their activity harder to detect. Per the Justice Department, QTFY offers computer hacking services to customers, including Chinese government hackers working for the Ministry of State Security, letting them use the botnet.
The hacks date back to 2018 and affected NASA, the Federal Reserve, and the Departments of Energy, Justice, and Health and Human Services. The US Senate was targeted as recently as 2026, according to the government’s affidavit seeking a court order to seize the botnet’s domains, filed earlier this week. The NSA said in a separate advisory that the hackers scanned the Senate’s networks but were unsuccessful in gaining access.
The Justice Department said the domain seizures made the botnet and its command-and-control servers “inoperable,” since the domains were hardcoded into the botnet’s code and critical to its communication and operations.
Network giant Lumen said in a blog post that it had observed the hackers profiling and targeting government agencies, the defense and aerospace sectors, and other targets over the past year, and had shared threat intelligence with the FBI.
Why it matters
The takedown shows US authorities using civil domain seizures as a tool against state-linked infrastructure attacks, even as the same botnet’s alleged customer base — Chinese government hacking units — likely retains the ability to rebuild elsewhere.